User Profile Builder < 3.10.9 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update

Description The plugin is vulnerable to unauthorized modification of data due to a missing capability check on the 'wppbtwofactorauthenticationsettingsupdate' function in all versions up to, and including, 3.10.8. This makes it possible for unauthenticated attackers to enable or disable the 2FA...

WordPress SalesKing Plugin <= 1.6.15 is vulnerable to Settings Change

Software SalesKing Type Plugin Vulnerable versions = 1.6.15 Fixed in 1.6.30 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-22156 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 22c1687edcfd Credits Dave Jong Patchstack Required...

WordPress Eazy Plugin Manager Plugin <= 4.1.2 is vulnerable to Settings Change

Software Eazy Plugin Manager Type Plugin Vulnerable versions = 4.1.2 Fixed in 4.1.3 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2023-51482 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID c77a30c2a9bf Credits Rafie Muhammad Patchstack...

WordPress FunnelKit Checkout Plugin <= 3.10.3 is vulnerable to Settings Change

Software FunnelKit Checkout Type Plugin Vulnerable versions = 3.10.3 Fixed in 3.11.0 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2023-51670 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f342e4f6141d Credits Dave Jong Patchstack Required...

WordPress FunnelKit Checkout Plugin <= 3.10.3 is vulnerable to Settings Change

Software FunnelKit Checkout Type Plugin Vulnerable versions = 3.10.3 Fixed in 3.11.0 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2023-51671 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID f63332e6c6a9 Credits Dave Jong Patchstack Required...

WordPress Checkout Mestres WP Plugin <= 7.1.9.7 is vulnerable to Settings Change

Software Checkout Mestres WP Type Plugin Vulnerable versions = 7.1.9.7 Fixed in 7.1.9.8 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2023-51471 Patch priority High CVSS severity High 8.2 Developer Claim ownership PSID cfce7b38ed64 Credits Rafie Muhammad Patchstack...

WordPress BuddyBoss Theme Theme <= 2.4.60 is vulnerable to Settings Change

Software BuddyBoss Theme Type Theme Vulnerable versions = 2.4.60 Fixed in 2.4.61 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2023-51477 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 91b38329ee46 Credits Dave Jong Patchstack Required...

Is it required to change settings on the SFside when the configuration of DNS server changes?

It is not required to change settings on the StoreFront side when the the configuration of DNS server changes...

Ecwid Ecommerce Shopping Cart < 6.12.5 - Arbitrary Plugin Settings Change via CSRF

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. PoC http://vulnerable-site.tld/wp-admin/admin-ajax.php?action=ecwidstorefrontsetpageslug=hehehehe Besides, you can disable the...

CVE-2023-4690

The Elementor Addon Elements plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.12.7. This is due to missing or incorrect nonce validation on the eaesaveconfig function. This makes it possible for unauthenticated attackers to change configuration...

WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer Plugin <= 2.24.14 is vulnerable to Settings Change

Software 10Web Booster – Website speed optimization, Cache & Page Speed optimizer Type Plugin Vulnerable versions = 2.24.14 Fixed in 2.24.18 OWASP Top 10 A3: Injection Classification Settings Change CVE N/A Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 75375faf9c46...

CVE-2023-40125

In onCreate of ApnEditor.java, there is a possible way for a Guest user to change the APN due to a permission bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

WordPress Deeper Comments Plugin <= 2.1.1 is vulnerable to Settings Change

Software Deeper Comments Type Plugin Vulnerable versions = 2.1.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE N/A Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 319b7c9766ae Credits Jerome Bruandet Required privilege Subscriber...

WordPress Themify Ultra Theme <= 7.3.5 is vulnerable to Settings Change

Software Themify Ultra Type Theme Vulnerable versions = 7.3.5 Fixed in 7.3.6 OWASP Top 10 A5: Broken Access Control Classification Settings Change CVE CVE-2023-46148 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 4e68744a5277 Credits Rafie Muhammad Patchstack Required...

CVE-2023-30713

Improper privilege management vulnerability in FolderLockNotifier in One UI Home prior to SMR Sep-2023 Release 1 allows local attackers to change some settings of the folder lock...

Privilege escalation

Improper privilege management vulnerability in FolderLockNotifier in One UI Home prior to SMR Sep-2023 Release 1 allows local attackers to change some settings of the folder lock...

CVE-2023-2352

The CHP Ads Block Detector plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.9.4. This is due to missing or incorrect nonce validation on the chpabdaction function. This makes it possible for unauthenticated attackers to update or reset plugin...

Design/Logic Flaw

In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users to change user settings of other users...

CVE-2023-40282

Improper authentication vulnerability in Rakuten WiFi Pocket all versions allows a network-adjacent attacker to log in to the product's Management Screen. As a result, sensitive information may be obtained and/or the settings may be changed...

WordPress Media from FTP Plugin < 11.17 is vulnerable to Settings Change

Software Media from FTP Type Plugin Vulnerable versions 11.17 Fixed in 11.17 OWASP Top 10 A6: Security Misconfiguration Classification Settings Change CVE CVE-2023-4019 Patch priority Low CVSS severity Low 3.8 Developer Claim ownership PSID 12e9a53fc39c Credits Dmitrii Ignatyev Required privilege...